Remediation Cost Calculator
Cost a remediation campaign: engineering hours with testing overhead, downtime, tooling, cost per finding and FTE months needed.
About Remediation Cost Calculator
Two things make remediation cost estimates wrong in practice: forgetting the testing and change overhead, which is rarely below 25% for anything customer-facing, and costing engineer time at salary rather than at the opportunity cost of the roadmap work it displaces. The FTE-month output exists because budget approval usually hinges on whether the work fits the team you already have. Every remediation campaign competes for the same engineers as the product roadmap, and a cost per finding lets you argue for automation, golden images or decommissioning instead of brute force.
Formulas
Remediation Cost
Engineering hours = findings × hours per fix × (1 + testing overhead). Total cost = hours × rate + downtime hours × downtime cost + tooling. Cost per finding = total ÷ findings.
- testing overhead
- Uplift for regression testing, change paperwork and validation
- downtime cost
- Revenue or productivity lost per hour of outage
- FTE months
- Hours ÷ 130 productive hours per person-month
Capacity conversion
FTE months = engineering hours ÷ 130, using 130 productive hours per person-month rather than 160 to allow for meetings, interruptions and leave.
Worked example
With the default values below, Remediation Cost Calculator returns Total Remediation Cost of $226,600.00. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Findings to remediateaccepts 1–1,000,000 findings
- 480 findings
- Average engineering time per findingaccepts 0.1–200 hours
- 2.5 hours
- Blended engineering costaccepts 0–2,000 currency/hour
- 85 currency/hour
- Testing and change overheadaccepts 0–300 %
- 30 %
- Total planned downtimeaccepts 0–10,000 hours
- 12 hours
- Cost per hour of downtimeaccepts 0–10,000,000 currency/hour
- 4,500 currency/hour
- Tooling and licence cost for the campaignaccepts 0–100,000,000 currency
- 40,000 currency
Results
- Total Remediation Cost
- $226,600.00
- Engineering Cost
- $132,600.00
- Downtime Cost
- $54,000.00
- Cost per Finding
- $472.08
- Engineering Hours
- 1,560.0 hours
- FTE Months
- 12.00 FTE-months
- Largest Cost Line
- Engineering time — 1560 hours, or 12 FTE months
Step by step
- 1Values used
- 2Remediation Cost
- 3Capacity conversion
- 4Total Remediation Cost= 226,600.00
- 5Engineering Cost= 132,600.00
- 6Downtime Cost= 54,000.00
- 7Cost per Finding= 472.08
- 8Engineering Hours= 1,560.0 hours
- 9FTE Months= 12.00 FTE-months
Assumptions and limits
- The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Remediation Cost calculated?
Engineering hours = findings × hours per fix × (1 + testing overhead). Total cost = hours × rate + downtime hours × downtime cost + tooling. Cost per finding = total ÷ findings. Two things make remediation cost estimates wrong in practice: forgetting the testing and change overhead, which is rarely below 25% for anything customer-facing, and costing engineer time at salary rather than at the opportunity cost of the roadmap work it displaces. The FTE-month output exists because budget approval usually hinges on whether the work fits the team you already have.
Why does Remediation Cost matter?
Every remediation campaign competes for the same engineers as the product roadmap, and a cost per finding lets you argue for automation, golden images or decommissioning instead of brute force.
What values do I need to enter?
This calculator takes 7 inputs: Findings to remediate, Average engineering time per finding, Blended engineering cost, Testing and change overhead, Total planned downtime, Cost per hour of downtime, Tooling and licence cost for the campaign. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why 130 productive hours per FTE month?
Because a nominal 160-hour month loses time to meetings, incidents, interruptions and leave. Using 160 is the most common reason remediation plans slip by a third in their first month.
How do I bring the cost per finding down?
Batch it. Patching a golden image, bumping one shared dependency or decommissioning a host clears dozens of findings for the price of one change, which is why cost per finding falls fastest when you stop treating findings individually.
Related Calculators
You might also need
- Scanner False Positive Rate CalculatorCommonly used together
- Security Debt CalculatorCommonly used together
- Patch Window CalculatorCommonly used together
- Risk Reduction CalculatorCommonly used together
- Technical Debt Risk CalculatorCommonly used together
- Patch Priority CalculatorAlso in Vulnerability Management
